Re: kern/59168: kernel crash in iwm

["Michael van Elst via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/59168; it has been noted by GNATS.

From: mlelstv%serpens.de@localhost (Michael van Elst)
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/59168: kernel crash in iwm
Date: Tue, 11 Mar 2025 07:50:08 -0000 (UTC)

 gnats-admin%NetBSD.org@localhost ("Michael van Elst via gnats") writes:
 
 >The following reply was made to PR kern/59168; it has been noted by GNATS.
 
 >From: mlelstv%serpens.de@localhost (Michael van Elst)
 >To: gnats-bugs%netbsd.org@localhost
 >Cc: 
 >Subject: Re: kern/59168: kernel crash in iwm
 >Date: Tue, 11 Mar 2025 07:30:14 -0000 (UTC)
 
 > rwhitlock22%gmail.com@localhost writes:
 > 
 > >[ 43607.786698] panic: m_copydata(0xffff8ef8cd539068,88,0,0xffff918260855000): m=NULL, off=0 (0), len=12 (76)
 > >[ 43607.786698] cpu0: Begin traceback...
 > >[ 43607.786698] vpanic() at netbsd:vpanic+0x171
 > >[ 43607.786698] panic() at netbsd:panic+0x3c
 > >[ 43607.796698] m_copydata() at netbsd:m_copydata+0x13d
 > >[ 43607.796698] bus_dmamap_sync() at netbsd:bus_dmamap_sync+0x381
 > 
 > 
 > That's a mismatch between dma map and mbuf size. Usually without effect,
 > but if e.g. the data needs to be bounced, the mbuf is copied to a DMA
 > buffer and m_copydata() will notice if the mbuf is smaller than then
 > sync length and will panic.
 > 
 > iwm_rx_tx_cmd() does:
 > 
 >  bus_dmamap_sync(sc->sc_dmat, data->map, 0, IWM_RBUF_SIZE,
 >             BUS_DMASYNC_POSTREAD);
 
 
 
 Maybe not that sync operation. iwm_rx_tx_cmd() seems to be called for
 a RX buffer only.